Path: ccw.ch!elna.ethz.ch!news-zh.switch.ch!news-ge.switch.ch!newscore.univie.ac.at!europa.clark.net!195.173.173.151!woodstock.news.demon.net!demon!news.demon.co.uk!demon!pfwight.demon.co.uk!robin From: Robin Newsgroups: alt.os.windows95.crash.crash.crash,alt.out-of-body,alt.pagan,alt.pagan.contacts,alt.pagan.magick,alt.pantyhose,alt.paranet.metaphysics,alt.paranet.paranormal,alt.paranet.psi Subject: Re: Amateur Couple Pussy Pounder 47952 Date: Mon, 20 Apr 1998 10:51:01 +0100 Distribution: World Message-ID: References: <17049823.4917@freenet.columbus.oh.us> NNTP-Posting-Host: pfwight.demon.co.uk X-NNTP-Posting-Host: pfwight.demon.co.uk:193.237.108.8 X-Trace: news.demon.co.uk 893065907 nnrp-01:10218 NO-IDENT pfwight.demon.co.uk:193.237.108.8 X-Complaints-To: abuse@demon.net MIME-Version: 1.0 X-Newsreader: Turnpike (32) Trial Version 3.05 Lines: 38 I've complained to: abuse@skypoint.com postmaster@skypoint.com abuse@news.demon.co.uk abuse@freenet.columbus.oh.us Any other suggestions? In article <17049823.4917@freenet.columbus.oh.us>, wmreed@freenet.columbus.oh.us writes >Path: news.demon.co.uk!demon!woodstock.news.demon.net!demon!europa.clark.net!192 >.148.253.68!netnews.com!mr.net!newshub.tc.umn.edu!skypoint.com!freenet.columbus. >oh.us >From: wmreed@freenet.columbus.oh.us >Newsgroups: alt.os.windows95.crash.crash.crash,alt.out-of-body,alt.pagan,alt.pag >an.contacts,alt.pagan.magick,alt.pantyhose,alt.paranet.metaphysics,alt.paranet.p >aranormal,alt.paranet.psi >Subject: Amateur Couple Pussy Pounder 47952 >Date: Friday, 17 Apr 1998 23:49:17 -0600 >Organization: >Distribution: World >Message-ID: <17049823.4917@freenet.columbus.oh.us> >NNTP-Posting-Host: mykl.users.skypoint.com >Lines: 6 >Xref: news.demon.co.uk alt.os.windows95.crash.crash.crash:2224 alt.out-of- >body:2524 alt.pagan:8858 alt.pagan.contacts:530 alt.pagan.magick:1584 >alt.pantyhose:20119 alt.paranet.metaphysics:753 alt.paranet.paranormal:1300 >alt.paranet.psi:522 -- "...But the worst of all hatred Is that which is planned Against what we have In this goddess of land" - Levellers (Maid of the River) Robin ###### Path: ccw.ch!elna.ethz.ch!news-zh.switch.ch!news.belnet.be!newspump.monmouth.com!newspeer.monmouth.com!news-peer-east.sprintlink.net!news-peer.sprintlink.net!news.sprintlink.net!Sprint!newsfeed.internetmci.com!209.95.128.196!news-nyc.telia.net!masternews.telia.net!newsfeed1.swip.net!news.get2net.dk!not-for-mail From: "ras2" Newsgroups: alt.os.windows95.crash.crash.crash,alt.out-of-body,alt.pagan,alt.pagan.contacts,alt.pagan.magick,alt.pantyhose,alt.paranet.metaphysics,alt.paranet.paranormal,alt.paranet.psi Subject: Re: Amateur Couple Pussy Pounder 47952 Date: 20 Apr 98 16:59:39 +0200 Organization: email; remove any letters between 'd' and 'k' Lines: 33 Message-ID: <353B7EFB.MD-0.198.ras2@get2net.dangstk> References: NNTP-Posting-Host: port18.pulje205.get2net.dk Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Newsreader: MicroDot-II 0.198/CabalOS On Mon, 20 Apr 1998 10:51:01 +0100, Robin wrote: > I've complained to: [...] > abuse@freenet.columbus.oh.us That one is forged, if I remember correctly, but they might appreciate the information anyway. This particular spammer has used a lot of forged addresses. > Any other suggestions? Normally one would go after the site that hosts the web page mentioned (you snipped that part, so I'm not sure which of them it was), as that's the best way of stopping the spammers. They can get a lot of free accounts, but if the page is gone, there's no reason for them to spam. In this case, however, I've heard that at least one of the pages mentioned in the spam are innocent, so to speak. The spammer wants the domain to be flooded with complaints for some reason. Complain anyway, as you can't know if they're innocent. I believe that skypoint has nuked the account used, but last night the spammer was posting through an open server in Finland. Quite active this one. Hopefully he will run out of steam soon; it's getting rather annoying. BTW, it's a bad idea to quote the entire headers (and the text) as some of the cancelbots may accidently trigger on that and cancel your post (and automatically send a complaint to your ISP if you're really unlucky). -R. ###### Path: ccw.ch!elna.ethz.ch!news-zh.switch.ch!news.belnet.be!news-penn.gip.net!news-peer.gip.net!news.gsl.net!gip.net!news.idt.net!woodstock.news.demon.net!demon!news.demon.co.uk!demon!pfwight.demon.co.uk!robin From: Robin Newsgroups: alt.os.windows95.crash.crash.crash,alt.out-of-body,alt.pagan,alt.pagan.contacts,alt.pagan.magick,alt.pantyhose,alt.paranet.metaphysics,alt.paranet.paranormal,alt.paranet.psi Subject: Re: Amateur Couple Pussy Pounder 47952 Date: Tue, 21 Apr 1998 11:01:31 +0100 Message-ID: References: <353B7EFB.MD-0.198.ras2@get2net.dangstk> NNTP-Posting-Host: pfwight.demon.co.uk X-NNTP-Posting-Host: pfwight.demon.co.uk:193.237.108.8 X-Trace: news.demon.co.uk 893153862 nnrp-04:26239 NO-IDENT pfwight.demon.co.uk:193.237.108.8 X-Complaints-To: abuse@demon.net MIME-Version: 1.0 X-Newsreader: Turnpike (32) Trial Version 3.05 Lines: 50 In article <353B7EFB.MD-0.198.ras2@get2net.dangstk>, ras2 writes >On Mon, 20 Apr 1998 10:51:01 +0100, Robin wrote: >> I've complained to: >[...] >> abuse@freenet.columbus.oh.us > >That one is forged, if I remember correctly, >but they might appreciate the information anyway. >This particular spammer has used a lot of forged >addresses. > >> Any other suggestions? > >Normally one would go after the site that hosts the web page >mentioned (you snipped that part, so I'm not sure which of them >it was), as that's the best way of stopping the spammers. They >can get a lot of free accounts, but if the page is gone, there's >no reason for them to spam. >In this case, however, I've heard that at least one of the pages >mentioned in the spam are innocent, so to speak. The spammer >wants the domain to be flooded with complaints for some reason. >Complain anyway, as you can't know if they're innocent. > >I believe that skypoint has nuked the account used, but last >night the spammer was posting through an open server in >Finland. Quite active this one. Hopefully he will run out of >steam soon; it's getting rather annoying. > >BTW, it's a bad idea to quote the entire headers (and the text) >as some of the cancelbots may accidently trigger on that and >cancel your post (and automatically send a complaint to your >ISP if you're really unlucky). > >-R. Thanks! I'd never thought of the problem about quoting whole headers... The idea of posting to the hosting site is a good one, but how do I translate it if only the 999.999.999.999 type is listed rather than the domain name? -- "...But the worst of all hatred Is that which is planned Against what we have In this goddess of land" - Levellers (Maid of the River) Robin ###### Path: ccw.ch!elna.ethz.ch!news-zh.switch.ch!news.belnet.be!newspump.monmouth.com!newspeer.monmouth.com!news.msfc.nasa.gov!europa.clark.net!205.252.116.205!howland.erols.net!newshub.northeast.verio.net!news-pen-3.sprintlink.net!news-pen-1.sprintlink.net!news.sprintlink.net!Sprint!newsfeed1.swip.net!news.get2net.dk!not-for-mail From: "ras2" Newsgroups: alt.os.windows95.crash.crash.crash,alt.out-of-body,alt.pagan,alt.pagan.contacts,alt.pagan.magick,alt.pantyhose,alt.paranet.metaphysics,alt.paranet.paranormal,alt.paranet.psi Subject: Re: Amateur Couple Pussy Pounder 47952 Date: 21 Apr 98 16:25:57 +0200 Organization: email; remove any letters between 'd' and 'k' Lines: 36 Message-ID: <353CC895.MD-0.198.ras2@get2net.dtgk> References: NNTP-Posting-Host: port28.pulje205.get2net.dk Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Newsreader: MicroDot-II 0.198/CabalOS On Tue, 21 Apr 1998 11:01:31 +0100, Robin wrote: > The idea of posting to the hosting site is a good one, but how do I > translate it if only the 999.999.999.999 type is listed rather than the > domain name? You can do a DNS lookup on those to get the 'canonical' name. Unfortunately, I don't know which software is available for your computer, but on the links below you can find some different tools, so you can do a lookup from the web. There's a lot of other information there too, and links to other sites about spam fighting. That should also enable you to figure out who is really hosting the site, as the name you get from a DNS lookup is usually just an alias. http://www.sputum.com/cns/tools.html http://www.abuse.net/ http://spam.abuse.net/ news.admin.net-abuse.usenet is a very good place to ask for more info (and quite an interesting place to lurk if you have the time). They can explain things better than I, too. alt.current-events.net-abuse.spam can also be used, but it's usually rather inactive. BTW, look for a link to a program called Sam Spade on the sites above. It should be quite good for tracking spammers, so if it runs on your computer platform, it might be worth using. DNS lookup, whois, traceroute and other tools should be included in it. HTH, -R. ###### Path: ccw.ch!usenet From: Neil Franklin Newsgroups: alt.os.windows95.crash.crash.crash,alt.out-of-body,alt.pagan,alt.pagan.contacts,alt.pagan.magick,alt.pantyhose,alt.paranet.metaphysics,alt.paranet.paranormal,alt.paranet.psi Subject: Re: Amateur Couple Pussy Pounder 47952 Date: Wed, 22 Apr 1998 01:43:13 +0200 Organization: My own Private Self Lines: 19 Message-ID: <353D2F11.8BB81009@ccw.ch> References: <353B7EFB.MD-0.198.ras2@get2net.dangstk> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Mailer: Mozilla 4.04 [en] (X11; I; Linux 2.0.27 i486) ras2 wrote: > BTW, it's a bad idea to quote the entire headers (and the text) > as some of the cancelbots may accidently trigger on that and > cancel your post (and automatically send a complaint to your > ISP if you're really unlucky). I disagree strongly with this one. For a simple reason: Cancelbots act on News postings, but you are sending the header in an personal email to the ISP. So there will be no cancelbot seeing it. OTOH anything missing from the header can make the ISPs job more difficult and can make them believe you are not trustworthy. -- Neil.Franklin.remove@ccw.ch http://www.ccw.ch/Neil.Franklin/ franklin.remove@arch.ethz.ch http://caad.arch.ethz.ch/~franklin/ This computer has 2 cats, one in /bin, one on top purring. ###### Path: ccw.ch!usenet From: Neil Franklin Newsgroups: alt.os.windows95.crash.crash.crash,alt.out-of-body,alt.pagan,alt.pagan.contacts,alt.pagan.magick,alt.pantyhose,alt.paranet.metaphysics,alt.paranet.paranormal,alt.paranet.psi Subject: Re: Amateur Couple Pussy Pounder 47952 Date: Wed, 22 Apr 1998 01:53:27 +0200 Organization: My own Private Self Lines: 42 Message-ID: <353D3177.4EA9DD16@ccw.ch> References: <353CC895.MD-0.198.ras2@get2net.dtgk> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Mailer: Mozilla 4.04 [en] (X11; I; Linux 2.0.27 i486) ras2 wrote: > > On Tue, 21 Apr 1998 11:01:31 +0100, Robin wrote: > > > The idea of posting to the hosting site is a good one, but how do I > > translate it if only the 999.999.999.999 type is listed rather than the > > domain name? > > You can do a DNS lookup on those to get the 'canonical' name. Unfortunately for you, this usually fails. Aftr all the news servers on the way did exactly this, to generate the Path: line. The best chance at finding the best ISP to target with an complaint is by looking at the NNTP-Posting-Host: line in the header. That gets stamped in there by the server where the post was accepted from the posters newsreader/writer. Faking this one is AFAIK impossible, as posts comming in from an newsreader with this field in them are refused (I know this because my newsreader/poster posts to an news server on my machine and then I have to elliminate this field before sending the post to my ISPs news server, been there, done that). These are the people who must block their local spammer, before the messages get into the nets replication mechanisms. And they are also those with an contract containing hopefully AUP clauses. > That should also enable you to figure out who is really hosting > the site, as the name you get from a DNS lookup is usually > just an alias. Who hosts the site is only relevant for email and web. For news the important one is the one who feeds the site. The NNTP-Posting-Host: comes from them. -- Neil.Franklin.remove@ccw.ch http://www.ccw.ch/Neil.Franklin/ franklin.remove@arch.ethz.ch http://caad.arch.ethz.ch/~franklin/ This computer has 2 cats, one in /bin, one on top purring. ###### Path: ccw.ch!elna.ethz.ch!news-zh.switch.ch!news-ge.switch.ch!feed1.news.luth.se!luth.se!masternews.telia.net!newsfeed1.swip.net!news.get2net.dk!not-for-mail From: "ras2" Newsgroups: alt.os.windows95.crash.crash.crash,alt.out-of-body,alt.pagan,alt.pagan.contacts,alt.pagan.magick,alt.pantyhose,alt.paranet.metaphysics,alt.paranet.paranormal,alt.paranet.psi Subject: Re: Amateur Couple Pussy Pounder 47952 Date: 22 Apr 98 07:19:01 +0200 Organization: email; remove any letters between 'd' and 'k' Lines: 57 Message-ID: <353D99E5.MD-0.198.ras2@get2net.drrrk> References: <353D3177.4EA9DD16@ccw.ch> NNTP-Posting-Host: port22.pulje201.get2net.dk Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Newsreader: MicroDot-II 0.198/CabalOS On Wed, 22 Apr 1998 01:53:27 +0200, Neil Franklin wrote: > ras2 wrote: > > On Tue, 21 Apr 1998 11:01:31 +0100, Robin wrote: > > > > > The idea of posting to the hosting site is a good one, but how do I > > > translate it if only the 999.999.999.999 type is listed rather than the > > > domain name? > > > > You can do a DNS lookup on those to get the 'canonical' name. > > Unfortunately for you, this usually fails. Aftr all the news > servers on the way did exactly this, to generate the Path: line. This was when only a DNS-address URL is advertised instead of a named site in the spam. > The best chance at finding the best ISP to target with an > complaint is by looking at the NNTP-Posting-Host: line in the > header. That gets stamped in there by the server where the post > was accepted from the posters newsreader/writer. > > Faking this one is AFAIK impossible, as posts comming in from an > newsreader with this field in them are refused (I know this > because my newsreader/poster posts to an news server on my > machine and then I have to elliminate this field before sending > the post to my ISPs news server, been there, done that). But not all servers add a NNTP-Posting-Host: header, so it can be forged from those sites. I can't add one, because my server, like yours, adds it, but somebody posting through a server that doesn't add it could insert my NNTP-Posting-Host in his headers. Somebody did that actually. It's not all that trustworthy, especially since many of the open servers that are abused by the spammers are running obsolete software or are misconfigured. > > That should also enable you to figure out who is really hosting > > the site, as the name you get from a DNS lookup is usually > > just an alias. > > Who hosts the site is only relevant for email and web. For news > the important one is the one who feeds the site. The > NNTP-Posting-Host: comes from them. You must have missed the first posts in this thread. Normally, if a website is advertised in the spam, you complain to the site that hosts it in an attempt to get it shut down. If that succeeds, the spammer won't have anything to spam for. He can get another dial up account easily enough, but having to move his site is more problematic/expensive and thus hurts him more. Most responsible providers nuke a website/home page even if the spam for it doesn't come from their domain. Even netcom.com has started doing this lately (took them a long time to get a clue, though). -R. ###### Path: ccw.ch!elna.ethz.ch!news-zh.switch.ch!news-ge.switch.ch!news-fra1.dfn.de!news-koe1.dfn.de!news.ruhrgebiet.individual.net!fci-se!fci!masternews.telia.net!newsfeed1.swip.net!news.get2net.dk!not-for-mail From: "ras2" Newsgroups: alt.os.windows95.crash.crash.crash,alt.out-of-body,alt.pagan,alt.pagan.contacts,alt.pagan.magick,alt.pantyhose,alt.paranet.metaphysics,alt.paranet.paranormal,alt.paranet.psi Subject: Re: Amateur Couple Pussy Pounder 47952 Date: 22 Apr 98 09:16:35 +0200 Organization: email; remove any letters between 'd' and 'k' Lines: 22 Message-ID: <353DB573.MD-0.198.ras2@get2net.dhhhk> References: <353D2F11.8BB81009@ccw.ch> NNTP-Posting-Host: port52.pulje202.get2net.dk Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Newsreader: MicroDot-II 0.198/CabalOS On Wed, 22 Apr 1998 01:43:13 +0200, Neil Franklin wrote: > ras2 wrote: > > BTW, it's a bad idea to quote the entire headers (and the text) > > as some of the cancelbots may accidently trigger on that and > > cancel your post (and automatically send a complaint to your > > ISP if you're really unlucky). > > I disagree strongly with this one. For a simple reason: > > Cancelbots act on News postings, but you are sending the header > in an personal email to the ISP. So there will be no cancelbot > seeing it. > > OTOH anything missing from the header can make the ISPs job more > difficult and can make them believe you are not trustworthy. It is a bad idea to quote the entire spam in a post on Usenet. That was what we were talking about. Wouldn't have mentioned a cancelbot otherwise. Of course the entire spam should be included in the complaint to the ISP. ###### Path: ccw.ch!usenet From: Neil Franklin Newsgroups: alt.os.windows95.crash.crash.crash,alt.out-of-body,alt.pagan,alt.pagan.contacts,alt.pagan.magick,alt.pantyhose,alt.paranet.metaphysics,alt.paranet.paranormal,alt.paranet.psi Subject: Re: Amateur Couple Pussy Pounder 47952 Date: Thu, 23 Apr 1998 00:15:55 +0200 Organization: My own Private Self Lines: 62 Message-ID: <353E6C1B.AA294745@ccw.ch> References: <353D3177.4EA9DD16@ccw.ch> <353D99E5.MD-0.198.ras2@get2net.drrrk> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Mailer: Mozilla 4.04 [en] (X11; I; Linux 2.0.27 i486) ras2 wrote: > > On Wed, 22 Apr 1998 01:53:27 +0200, Neil Franklin wrote: > > ras2 wrote: > > > On Tue, 21 Apr 1998 11:01:31 +0100, Robin wrote: > > > > translate it if only the 999.999.999.999 type is listed rather than the > > > You can do a DNS lookup on those to get the 'canonical' name. > > Unfortunately for you, this usually fails. Aftr all the news > > servers on the way did exactly this, to generate the Path: line. > This was when only a DNS-address URL is advertised instead of > a named site in the spam. O.K. when there is an Website that is being spammed you can go after the Web server provider. That is possible, even very effective, as the spammer loses not just Usenet access but also the resource he has spammed for. BTW: the 999.999.999.999 things are called IP addresses. The names host.domain.com are called DNS addresses. > > The best chance at finding the best ISP to target with an > > complaint is by looking at the NNTP-Posting-Host: line in the > > > > Faking this one is AFAIK impossible, as posts comming in from an > But not all servers add a NNTP-Posting-Host: header, so it > can be forged from those sites. That is true, old news servers leak here. I suppose in this case one will have to go to that news servers news feed. Spam will only disappear when all posters have to have an official contract with an ISP to post and can be stripped of it when abusing. > It's not all that trustworthy, especially since many of the open > servers that are abused by the spammers are running obsolete > software or are misconfigured. Force the server operator to upgrade, configure properly or get off the net. The alternative is spamming of the entire net :-(. The cancelbot operators are striking exactly to make this point. Spam must be stopped at the source. > > Who hosts the site is only relevant for email and web. For news > > the important one is the one who feeds the site. The > > NNTP-Posting-Host: comes from them. > > You must have missed the first posts in this thread. > Normally, if a website is advertised in the spam, you complain > to the site that hosts it in an attempt to get it shut down. I did not get the original spam. My news server seems to have killed it already. The first post I got in this thread was Robin reporting he had complained to 4 addresses and then ras2 claiming that headers in complaints will trigger cancelbots. -- private: Neil.Franklin.remove@ccw.ch http://www.ccw.ch/Neil.Franklin/ office: franklin.remove@arch.ethz.ch http://caad.arch.ethz.ch/~franklin/ This computer has 2 cats, one in /bin, one on top purring. ###### Path: ccw.ch!elna.ethz.ch!news-zh.switch.ch!news.belnet.be!newspump.monmouth.com!newspeer.monmouth.com!netnews.com!news-peer.sprintlink.net!news.sprintlink.net!newsfeed.internetmci.com!209.95.128.196!news-nyc.telia.net!masternews.telia.net!newsfeed1.swip.net!news.get2net.dk!not-for-mail From: "ras2" Newsgroups: alt.os.windows95.crash.crash.crash,alt.out-of-body,alt.pagan,alt.pagan.contacts,alt.pagan.magick,alt.pantyhose,alt.paranet.metaphysics,alt.paranet.paranormal,alt.paranet.psi Subject: Re: Amateur Couple Pussy Pounder 47952 Followup-To: alt.current-events.net-abuse.spam Date: 23 Apr 98 18:25:52 +0200 Organization: email; remove any letters between 'd' and 'k' Lines: 89 Message-ID: <353F87B0.MD-0.198.ras2@get2net.dpppk> References: <353E6C1B.AA294745@ccw.ch> NNTP-Posting-Host: p204-16.ppp.get2net.dk Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Newsreader: MicroDot-II 0.198/CabalOS On Thu, 23 Apr 1998 00:15:55 +0200, Neil Franklin wrote: > ras2 wrote: > BTW: the 999.999.999.999 things are called IP addresses. The names > host.domain.com are called DNS addresses. yup. I get the terms mixed up sometimes. > > But not all servers add a NNTP-Posting-Host: header, so it > > can be forged from those sites. > > That is true, old news servers leak here. I suppose in this case one > will have to go to that news servers news feed. Spam will only disappear > when all posters have to have an official contract with an ISP to post > and can be stripped of it when abusing. There are even some ISPs with modern equpiment where the servers don't add that header. I think alt.net/Altopia still refuses to configure their servers to add it (but I can only remember seeing forgeries from there, not spam). If the ISPs would just be serious about enforcing their TOS, it could help much. Many of them take spam much too lightly. Some don't even read the mails to their posmaster/abuse addresses. It happens much too often that you complain, get a bot-reply if you're lucky, and then nothing happens. The spam continues to be posted. > > It's not all that trustworthy, especially since many of the open > > servers that are abused by the spammers are running obsolete > > software or are misconfigured. > > Force the server operator to upgrade, configure properly or get off the > net. The alternative is spamming of the entire net :-(. The cancelbot > operators are striking exactly to make this point. Spam must be stopped > at the source. Yes. The Spam Cancel Moratorium officially ended last friday, so it only lasted two weeks and Cosmo Roadkill wasn't shut down, which meant that the effects unfortunately weren't as severe as expected. Seems it did some good though, as several ISPs have started filtering now, more than before the moratorium, at least. Sometimes, in my more demoralized moments, I'm wishing the anti-spammers would just UDP all sites that can't get their act together. It's a serious thing to do, of course, but too many sites just don't care about Usenet. A UDP often seems to be the only thing that will convince them. Got the point across to both TIAC and netcom.com earlier this year, for example (and that was only the threat of a UDP). > > > Who hosts the site is only relevant for email and web. For news > > > the important one is the one who feeds the site. The > > > NNTP-Posting-Host: comes from them. > > > > You must have missed the first posts in this thread. > > Normally, if a website is advertised in the spam, you complain > > to the site that hosts it in an attempt to get it shut down. > > I did not get the original spam. My news server seems to have killed it > already. Lucky you. Then you probably haven't seen much of the recent porn spam spew. The cancelbots seem to have missed most of it, but with very short spams and a random text-string added to each of them, they can be hard to detect. I think that both the Spam Hippo and the Cleanfeed filters caught much of it. Better to filter than to cancel anyway. My admin seems to be rather clueless/uninterested in Usenet, but I'm trying to convince him to start filtering. Not an easy task with a standard commercial ISP. > The first post I got in this thread was Robin reporting he had > complained to 4 addresses and then ras2 claiming that headers in > complaints will trigger cancelbots. That was NOT what I claimed, as I've explained in another reply. I said that quoting the full headers in a Usenet post can trigger the bots. That I mentioned cancelbots should have made it clear, that it was Usenet I was talking about. If this thread is going to continue we should take it elsewhere. It's crossposted to as many groups as the original spam. Follow-ups set to alt.current-events.net-abuse.spam where it should be more on topic (though discussions about spam could be claimed to be on topic on most of Usenet). -R. ###### Path: ccw.ch!elna.ethz.ch!news-zh.switch.ch!news.belnet.be!news-penn.gip.net!news-peer.gip.net!news.gsl.net!gip.net!news-peer.sprintlink.net!news-backup-west.sprintlink.net!news.sprintlink.net!Sprint!165.166.15.6!news2.infoave.net!not-for-mail From: efarrel@hotmail.com (efarrel) Newsgroups: alt.os.windows95.crash.crash.crash,alt.out-of-body,alt.pagan,alt.pagan.contacts,alt.pagan.magick,alt.pantyhose,alt.paranet.metaphysics,alt.paranet.paranormal,alt.paranet.psi Subject: Re: Amateur Couple Pussy Pounder 47952 Date: 24 Apr 1998 01:23:08 GMT Organization: Info Avenue Internet Services Lines: 18 Message-ID: <6hophs$c57$1@news1.infoave.net> References: <353CC895.MD-0.198.ras2@get2net.dtgk> NNTP-Posting-Host: 206.74.39.217 Mime-Version: 1.0 Content-Type: Text/Plain; charset=US-ASCII X-Newsreader: WinVN 0.99.9 (Released Version) (x86 32bit) You can find Sam Spade at http://www.blighty.com/spam/spade.html I truns under windows. In article <353CC895.MD-0.198.ras2@get2net.dtgk>, ras2@get2net.dtgk says... >You can do a DNS lookup on those to get the 'canonical' name. >Unfortunately, I don't know which software is available for your >BTW, look for a link to a program called Sam Spade on the >sites above. It should be quite good for tracking spammers, >so if it runs on your computer platform, it might be worth >using. DNS lookup, whois, traceroute and other tools should >be included in it. > >HTH, > >-R. ###### Path: ccw.ch!elna.ethz.ch!news-zh.switch.ch!news.belnet.be!news-penn.gip.net!news-peer.gip.net!news.gsl.net!gip.net!ix.netcom.com!news From: bartma12@ix.netcom.com(Bart Scott) Newsgroups: alt.os.windows95.crash.crash.crash,alt.out-of-body,alt.pagan,alt.pagan.contacts,alt.pagan.magick,alt.pantyhose,alt.paranet.metaphysics,alt.paranet.paranormal,alt.paranet.psi Subject: Re: Amateur Couple Pussy Pounder 47952 Date: 24 Apr 1998 01:54:53 GMT Organization: Netcom Lines: 11 Message-ID: <6hordd$lf3@sjx-ixn10.ix.netcom.com> References: <353CC895.MD-0.198.ras2@get2net.dtgk> <6hophs$c57$1@news1.infoave.net> NNTP-Posting-Host: clv-oh40-76.ix.netcom.com X-NETCOM-Date: Thu Apr 23 6:54:53 PM PDT 1998 I look at the subject title and I think to myself, "I could have used an 'amateur-couple-pussy-pounder' when the kittens were ripping all the screens and drapes to shreads..." ... so sad... Bart ###### Path: ccw.ch!elna.ethz.ch!news-zh.switch.ch!news-ge.switch.ch!news-fra1.dfn.de!news-was.dfn.de!nntp-out.monmouth.com!newspeer.monmouth.com!peerfeed.ncal.verio.net!news.ncal.verio.com!not-for-mail From: "rbwalton" Newsgroups: alt.out-of-body Subject: Re: Amateur Couple Pussy Pounder 47952 Date: Sun, 26 Apr 1998 18:29:31 -0700 Organization: Verio Northern California's Usenet News Service Lines: 27 Message-ID: <6i0n1d$2rn$1@news.ncal.verio.com> References: <353CC895.MD-0.198.ras2@get2net.dtgk> <6hophs$c57$1@news1.infoave.net> <6hordd$lf3@sjx-ixn10.ix.netcom.com> <3543CBA0.134E@mcleodusa.net> NNTP-Posting-Host: cyrax48.arcology.net X-Newsreader: Microsoft Outlook Express 4.71.1712.3 X-MimeOLE: Produced By Microsoft MimeOLE V4.71.1712.3 You mean those messages are about cats? I love cats. . . . -- Richard Visit this web page for some useful OOB links. . . www.angelfire.com/ca/onestepbeyond/ To respond, delete #nospam# rbwalton@#nospam#outrageous.net themissinglink wrote in message <3543CBA0.134E@mcleodusa.net>... >Bart Scott wrote: >> >> I look at the subject title and I think to myself, "I could have used >> an 'amateur-couple-pussy-pounder' when the kittens were ripping all the >> screens and drapes to shreads..." >> >> ... so sad... >> >> Bart > >This is precisely why I love you, Bart! ###### Path: ccw.ch!elna.ethz.ch!news-zh.switch.ch!news.belnet.be!news-penn.gip.net!news-peer.gip.net!news.gsl.net!gip.net!howland.erols.net!netnews.com!newsin.iconnet.net!news.mcleodusa.net!news From: themissinglink Newsgroups: alt.os.windows95.crash.crash.crash,alt.out-of-body,alt.pagan,alt.pagan.contacts,alt.pagan.magick,alt.pantyhose,alt.paranet.metaphysics,alt.paranet.paranormal,alt.paranet.psi Subject: Re: Amateur Couple Pussy Pounder 47952 Date: Sun, 26 Apr 1998 19:04:48 -0500 Organization: By Divine Design Lines: 11 Message-ID: <3543CBA0.134E@mcleodusa.net> References: <353CC895.MD-0.198.ras2@get2net.dtgk> <6hophs$c57$1@news1.infoave.net> <6hordd$lf3@sjx-ixn10.ix.netcom.com> NNTP-Posting-Host: 211-A-36-190.ppp.mcleodusa.net Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Mailer: Mozilla 3.04Gold (Win95; I) Bart Scott wrote: > > I look at the subject title and I think to myself, "I could have used > an 'amateur-couple-pussy-pounder' when the kittens were ripping all the > screens and drapes to shreads..." > > ... so sad... > > Bart This is precisely why I love you, Bart!